Map header
Business:
Map owner:
Backup owner:
Date filled in:
Next review date:
Who helped fill it in:
The data map
Copy this block once for each kind of customer detail you keep.
Kind of data (for example name and phone, address, ID proof, health or test details, payment details, photos):
- Why we collect it (in one plain line):
- Where it is kept (every place, including phones and paper):
- Who can see or change it (by name or role):
- Outside apps or vendors that hold a copy:
- AI tools that see it, and what for:
- How long we keep it, and who deletes it:
- What the customer is told when we collect it:
- Risky or unclear (yes or no, and why):
AI tools and outside apps
For each tool or app that touches customer data:
- Tool or app:
- Which kinds of data go into it:
- Who uses it:
- Paid business account or free personal account:
- Have we read what it does with the data we put in (yes, no, not sure):
- Allowed for customer data (yes, no, only with details removed):
When a customer asks
- Who handles a customer asking what data we hold about them:
- Who handles a request to correct or delete their details:
- Where those requests are recorded:
If something goes wrong
What counts as a problem (a lost phone with customer chats, a file sent to the wrong person, a leaked sheet):
Who must be told straight away:
Who decides what to tell customers and any authority, after taking legal advice:
Where it is recorded:
Open questions for our lawyer
Owner and review
Named owner for this map:
Review date:
Change that triggers an early review (a new app, a new branch, a new AI tool, a staff member leaving):
Stop rules
- Do not paste health, ID or payment details into any AI tool that is not on the allowed list above.
- If you do not know where a kind of data lives or who can see it, write "not known" and add it to the open questions. Do not fill gaps with guesses.
- This map is not legal advice. Do not rewrite consent forms, privacy notices or vendor contracts from it alone; take it to a lawyer first.
- When a staff member leaves, check their access in every place on the map that week.
- Do not record deadlines or legal duties in the map unless they come from a lawyer or the official text, with the source written next to them.